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(57) Abstract: A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, 
virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for 
delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing sys- 
tem, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to 
a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality 
of processors in the ring configuration and using the second processing system. 
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SYSTEM AND METHOD FOR 
DELIVERING SECURITY SERVICES 

5 

Field of the Invention 

This invention relates to the field of internet processors, and more 
specifically to a method and apparatus of delivering security services such as 
firewalls. 

10 

Background of the Invention 

The service provider game has grown extremely crowded and fiercely 
competitive, with numerous players offering similar products and services. 
While having a large number of comparable services is arguably beneficial to the 

15 enterprise, it poses a host of potentially disastrous consequences for a service 

provider. If all competitors in a given market are offering services that are 
indistinguishable by the customer base, the burden of differentiation falls 
squarely on cost, with the least-cost competitor emerging "victorious". Jockeying 
for the cost-leader position rapidly drives down service pricing, reducing margins 

20 to rubble and rendering the service a commodity. Furthermore, numerous 

offerings that are similar in attributes and cost make it very difficult to lock in 
customers. 

Operational costs also present a significant challenge to service providers. 
Cumbersome, manual provisioning processes are the primary culprits. Customer 
25 orders must be manually entered and processed through numerous antiquated 

back-end systems that have been pieced together. Once the order has been 
processed, a truck roll is required for onsite installation and configuration of 
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Customer Premises Equipment (CPE), as well as subsequent troubleshooting 
tasks. This is a slow and expensive process that cuts into margins and forces 
significant up-front charges to be imposed on the customer. In order to be 
successful in today's market, service providers must leverage the public network 
5 to offer high-value, differentiated services that maximize margins while 
controlling capital and operational costs. These services must be rapidly 
provisioned and centrally managed so that time-to-market and, more importantly, 
time-to-revenue are minimized. Traditional methods of data network service 
creation, deployment, and management present significant challenges to 
10 accomplishing these goals, calling for a new network service model to be 
implemented. 

Basic Internet access, a staple of service provider offerings, has been 
commoditized to the point that margins are nearly non-existent. This fact has 
driven service providers to look for new value-added features and services to 

15 layer over basic connectivity so that they are able to differentiate on factors other 
than cost. The most significant opportunity for differentiation is found in 
managed network services. Managed network services enable enterprise IT 
organizations to outsource time-consuming tactical functions so that they can 
focus strategic core business initiatives. 

20 Enterprise customers are now demanding cost-effective, outsourced 

connectivity and security services, such as Virtual Private Networks (VPNs) and 
managed firewall services. Enterprise networks are no longer segregated from 
the outside world; IT managers are facing mounting pressure to connect disparate 
business units, satellite sites, business partners, and suppliers to their corporate 

25 network, and then to the Internet. This raises a multitude of security concerns 
that are often beyond the core competencies of enterprise IT departments. To 
compound the problem, skilled IT talent is an extremely scarce resource. Service 
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providers, with expert staff and world-class technology and facilities, are well 
positioned to deliver these services to enterprise customers. 

While IT managers clearly see the value in utilizing managed network 
services, there are still barriers to adoption. Perhaps the most significant of these 
5 is the fear of losing control of the network to the service provider. In order to 

ease this fear, a successful managed network service offering must provide 
comprehensive visibility to the customer, enabling them to view configurations 
and performance statistics, as well as to request updates and changes. Providing 
IT managers with powerful Customer Network Management (CNM) tools 
10 bolsters confidence in the managed network service provider and can actually 
streamline the service provisioning and maintenance cycle. 

Customer P remises Equipment (CPE)-ha sed Managed Firewall Services 

Data network service providers have traditionally rolled out managed 
network service offerings by deploying specialized CPE devices at the customer 

15 site. This CPE is either a purpose-built network appliance that, in addition to 

providing specific service features, may also serve some routing function, or a 
mid to high-end enterprise-class server platform, typically UNIX-based. In the 
case of a managed firewall solution, the CPE device provides services that may 
include VPN tunnel termination, encryption, packet filtering, access control 

20 listings, and log files. The CPE at each customer site is aggregated at a 

multiplexer via leased lines and/or public Frame Relay PVCs (permanent virtual 
circuits) at the service provider POP (point of presence), then into a high-end 
access router and across the WAN (wide area network). 

In many cases, service providers and enterprise customers find it too 

25 expensive and cumbersome to deploy CPE-based security at every site, but rather 
deploy secure Internet access points at one or two of the largest corporate sites. 
In this model, all remote site Internet traffic is backhauled across the WAN to the 
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secure access point and then out onto the Internet, resulting in increased traffic on 
the corporate network and performance sacrifices. 

Service providers face significant challenges when deploying, managing 
and maintaining CPE-based managed firewall services. When a customer 

5 expresses interest in utilizing such a service, a consultation with experienced 
security professionals is required to understand the corporate network 
infrastructure and site-specific security requirements, yielding a complex set of 
security policies. This may be accomplished through a set of conference calls or 
a number of on-site visits. Once the security requirements and policies have been 

10 identified, the service provider must procure the CPE device. In some cases, the 
equipment vendor may provide some level of pre-configuration based upon 
parameters supplied by the service provider. While CPE vendors are driving 
towards delivering fully templatized, pre-configured systems that are plug-and- 
play by enterprise staff, most service providers still assume the responsibility for 

15 on-site, hands-on configuration, and a truck-roll to each of the customer sites is 
necessary. This is particularly true in server-based CPE systems, where a 
relatively high degree of technical sophistication and expertise is required to 
install and configure a UNIX-based system. 

Typically, a mid-level hardware and security specialist is sent onsite, 

20 along with an account manager, to complete the CPE installation and 

configuration. This specialist may be a service provider employee or a systems 
integrator/Value- Added Reseller (WAR) who has been contracted by the service 
provider to complete CPE rollout. This complex process begins with physical 
integration of the CPE device into the customer network. In the case of a CPE 

25 appliance, where the OS and firewall/VPN software components have been pre- 

loaded, the tech can immediately proceed to the system configuration phase. 
Server-based CPE services, however, require the additional time-consuming step 
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of loading the system OS and software feature sets, adding a further degree of 
complexity. 

In the configuration phase, the tech attempts to establish contact between 
the CPE device and central management system at the service provider NOC 
5 (network operations center). In cases where the device has not been previously 

assigned an IP address, an out-of-band signaling mechanism is required to 
complete the connection, typically a modem and a POTS line. If the integration 
process has been successful, NOC staff should be able to take over the process, 
pushing specific policy configurations (and possibly an IP address) down to the 

1 0. CPE device through a browser-driven management interface. This entire process 
must be repeated for every enterprise site utilizing the managed firewall service. 

Additionally, maintenance processes and costs for CPE-based managed 
firewall services can also be overwhelming to both the service provider and 
enterprise customers. Enterprises are forced to either keep cold spares onsite or 

15 be faced with periods of absent security when their firewall fails, a situation that 

is unacceptable to most of today's information intensive corporations. Service 
providers must have an inventory of spares readily available, as well as staff 
resources that can, if necessary, go onsite to repeat the system configuration 
process. Troubleshooting thousands of CPE devices that have been deployed at 

20 customer sites is an extremely formidable challenge, requiring extensive call 

center support resources, as well technicians that can be quickly deployed onsite. 

As CPE-based firewall services have traditionally been deployed in 
private enterprise networks, the original management systems for these devices 
have difficulty scaling up to manage several large, multi-site service provider 

25 customers. CPE device vendors are scrambling to ramp up these systems to 

carrier-grade and scale. Firewall management systems are typically GUI-based 
(graphical user interface-based), browser-driven interfaces that run on industrial 
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grade UNIX platforms in the service provider NOC. The management system 
interfaces with the CPE devices based on IP address. The CPE-based managed 
firewall model faces service providers with another issue: capital costs. In 
addition to the significant costs required to build out a POP/access infrastructure, 

5 including multiplexers and high-capacity access routers, the service provider 

must also assume the initial costs of the CPE device, including firewall and VPN 
software licensing charges. In many cases, these costs are passed on to the 
customer. This creates steep up-front costs that, coupled with per-site installation 
charges, can present a serious barrier to service adoption. In markets where 

10 several service providers are offering managed firewall services, a service 

provider may absorb the CPE cost to obtain a price leadership position, cutting 
deeply into margins. 

The CPE-based model is also limited when rolling out services beyond 
the managed firewall offering. New services, such as intrusion detection, may 

1 5 require additional hardware and/or software. This results in higher capital costs, 
as well as another expensive truck roll. 

Thus, there is a need for a method and apparatus of delivering a variety of 
network services, for example security services such as firewalls. 

20 Summary o f the Invention 

The present invention provides a flexible, scalable hardware and software 
platform that allows a service provider to easily provide internet services, virtual 
private network services, firewall services, etc., to a plurality of customers. This 
solution can be changes to provision each customer with more or less processing 
25 power and storage, according to individual changing needs. 

One aspect of the present invention provides a method of delivering 
security services. This method includes connecting a plurality of processors in a 
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ring configuration within a first processing system, establishing a secure 
connection between the processors in the ring configuration across an internet 
protocol (IP) connection to a second processing system to form a tunnel, and 
providing both router services and host services for a customer using the plurality 
5 of processors in the ring configuration and using the second processing system. 

Another aspect of the present invention provides a system of delivering 
security services. This system includes a plurality of processors in a ring 
configuration within a first processing system, and means for establishing a 
secure connection 418 between the processors in the ring configuration across an 
10 internet protocol (IP) connection to a second processing system to form a tunnel, 
. and for providing both router services and host services for a customer using the 
plurality of processors in the ring configuration and using the second processing 
system. 

Yet another aspect of the present invention provides a system 201 for 
15 delivering security services. This second system includes a plurality of 

processors within a first processing system connected in a ring configuration, and 
a tunnel formed using a secure connection between the processors in the ring 
configuration across an internet protocol (IP) connection to a second processing 
system, wherein both router services and host services are provided for a 
20 customer using the plurality of processors in the ring configuration and using the 
second processing system. 

Brief Description of the Drawings 

FIG. 1 is a block diagram of one embodiment of the present invention, system 
25 100 having a plurality of ISP boxes 1 10 connected to the internet 99 

FIG. 2 is a block diagram of one embodiment of the present invention, service 
provider network 200. 



7 



WO 02/23855 PC T/USO 1/28935 

FIG. 3 is a block diagram of one embodiment of the present invention, an IP 
service delivery platform 300. 

FIG. 4 is a block diagram of one embodiment of the present invention, a system 
400 providing a plurality of virtual private networks 410, 420, 430, 440. 
5 FIG. 5 is a block diagram of one embodiment of the present invention, a ring- 
network hardware platform 230. 

FIG. 6 is a block diagram of one embodiment of the present invention, service 
processing switch 600. 

FIG. 7 is a block diagram of one embodiment of the present invention, an 
10 integrated system 700 including conventional existing network elements. 

FIG. 8 is a block diagram of one embodiment of the present invention, hardware 
elements 230 and software elements 220. 

FIG. 9 is a block diagram of one embodiment of the present invention, 
multiprocessor system 900 using ring network 932. 
15 FIG. 10 shows a block diagram of a system 1000 for comparison. 

FIG. 1 1 shows a block diagram of a system 1 100 for comparison. 

FIG. 12 shows a block diagram of a system 1200 for comparison. 

FIG. 13 shows a block diagram of a system 1300 for comparison. 

FIG. 14 shows a graph of Checkpoint operational "soft" costs 1400. 
20 FIG. 15 shows a graph of five year total capital cost 1500. 



Description of Preferred Embodiments 

In the following detailed description of the preferred embodiments, 
reference is made to the accompanying drawings that form a part hereof, and in 
25 which are shown by way of illustration specific embodiments in which the 
invention may be practiced. It is understood that other embodiments may be 
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utilized and structural changes may be made without departing from the scope of 

the present invention. 

The leading digit(s) of reference numbers appearing in the Figures 

generally corresponds to the Figure number in which that component is first 

5 introduced, such that the same reference number is used throughout to refer to an 

identical component which appears in multiple Figures. Signals and connections 

may be referred to by the same reference number or label, and the actual meaning 

will be clear from its use in the context of the description. 

In some embodiments, the present invention deploys one or more virtual 

10 private networks (VPNs) running on one or more carrier-class platforms that 

scale to provide cost-effective solutions for internet service providers (ISPs). In 

particular, security services such as firewalls can be provided by the ISPs for 

services they provide to their customers, wherein a plurality of customers are 

hosted on a single network of processors. An ISP is providing hosting services 

15 (e.g., hosting an internet web site for a customer) and routing (moving data to and 

from the internet) for their customers. 

Figure 1 shows one embodiment of the present invention having a system 

100 that includes a plurality of similar ISP (internet service provider) boxes 110 

■ 

connected to the internet 99. In this embodiment, each box 110 represents a 
20 subsystem having routing services provided by a block called access router 111, 
and hosting services provided by blocks 113 and 114. The ISP is typically a 
company that provides internet services (such as connectivity to the internet, as 
well as servers that store data and provide data according to requests by users, 
and network connectivity to users) to a plurality of customers including customer 
25 A and customer B. In some embodiments, customer premises equipment 117 and 
1 18(also called CPE 117 and 118, this is hardware and the software that controls 
the hardware, that is installed at the customer's premises; this can include servers, 
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routers and switches, and the network connecting to individual user's 
workstations, and various interfaces to external communications networks) is 
used to provide at least a portion of the function to support customers A and B 
respectively, and the ISP 1 10 provides the rest in blocks 1 13 and 1 14 
5 respectively. The function to support customers includes such things as web site 
hosting, database and other servers, e-mail services, etc. The customer's CPE 
1 17 and 118 connect to the ISP through, e.g., access router 1 1 1 and security 
services 1 12 to customer A site one 1 13 and customer B site one 114, and also to 
the internet 99 in a manner that isolates customer A and customer B from one 
10 another except for communications and E-mail that would normally pass across 
the internet 99. 

Further, by establishing secure connections between two ISP boxes 1 10 
across the internet 99, a virtual private network or VPN 41 0 (see Figure 4 below) 
can be created. This function allows, for example, customer A's office at a first 

15 site (e.g., headquarters 1 17) to connect seamlessly to customer A's office at a 
second site (e.g., branch office 119) using what appears to them as a private 
network, but which actually includes some CPE at site 1 17, some services 1 13 
provided within ISP 110.1, a secure encrypted connection across internet 99, 
some services also in ISP 1 10.2, and some CPE at site 119. Users at sites 117 

20 and 119 can communicate with one another and share data and servers as if they 
were on a single private network provided by, e.g., VPN 410, 

FIG. 2 is a block diagram of one embodiment of the present invention, 
service provider (SP) network 200. A conventional network "cloud" 98 includes 
the SP's internet protocol (IP) or asynchronous transfer mode (ATM) core, as is 

25 well known in the internet art. IP system 201 connects to such existing 

infrastructure 98, as well as to other optional conventional hardware such as 
described in Figure 2 below, to provide SP network 200. IP System 201 provides 
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hardware 230 and software 220 to provide a plurality of virtual routers (VRs) 
210. Each VR 210 provides support for router services and server services such 
as those that provide customer site services 113 of Figure 1. Each VR 210 is 
supported by an object group 211, which is a group of generally dissimilar 
5 objects such as routing object 212, packet filtering object 213, firewall object 

212, network address translation (NAT) object 215, and/or other objects. In some 
embodiments, each VR 210 is a separate instantiation. 

In some embodiments, software 220 includes IP network operating system 
(IPNOS) 223, service management system (SMS) 221 (e.g., in some 

10 embodiments, this is the Invision™ software from CoSine Communications Inc., 
assignee of the present invention), and customer network management system 
(CNMS) 222 (e.g., in some embodiments, this is the Ingage™ software from 
CoSine Communications Inc., assignee of the present invention). SMS 221 
provides such services as configuration of blades 239, defining subscribers, 

15 determining services, and generation of IP security (IPSec) public/private key 
pairs. CNMS 222 provides such services as providing subscribers (customers) 
visibility to services. In some embodiments, CNMS software runs at least in part 
in a user's CPE or workstation, typically at a company's information services (IS) 
headquarters. 

20 In some embodiments, IP server switch (IPSX) hardware 230 includes one 

or more scalable hardware enclosures, each having a plurality of service "blades" 
239 (i.e., an insertable and removable printed circuit card having one or more 

* 

processors, each having its own CPU and memory) each connected in a ring 
configuration (such as a counter-rotating dual ring 232). In some embodiments, 
25 three types of blades 239 are provided: control blade(s) 234, processor blade(s) 
236, and access blade(s) 238. IPSX hardware also includes highly available, 

11 
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redundant, and hot-swappable hardware support 240 including power supplies 
241 and fans 242. 

FIG. 3 is a block diagram of one embodiment of the present invention, an 
IP service delivery platform (IPSDP) 300. The hardware and software of SP 
5 network 200 can be viewed as generating various network "clouds" such as edge 

cloud 95, access concentration cloud 96, and service processing cloud 97. These 
are built upon the existing conventional SP's IP or ATM core cloud 98 and they 
connect to the external internet cloud 99. IPSDP 300 includes an ISP's SP 
network 200 connected to one or more customer's offices 301 each of which 

10 includes some amount of CPE 1 10. In the embodiment shown, three corporate 

remote offices 301.1 are connected to SP network 200 using various conventional 
communications devices, well known to the art, such as frame relay switch 326, 
Ml 3 multiplexor (mux) 327, DSLAM (digital subscriber link access multiplexor) 
328, and dial-up RAS (remote access server) 329 (used to receive dial-up 

15 connections, for example, from the modem 3 1 1 connected to laptop computer 316 
in portable system 310 of dial-up telecommuter 301.3). In the embodiment 
shown, SP network 200 includes two systems 201, on connecting through frame 
relay switch 326, Ml 3 multiplexor (mux) 327, DSLAM 328, and dial-up RAS 
329 to remote office's CPE 1 10, and the other connecting directly to the 

20 customer's corporate headquarter's CPE 1110 (which also includes a control and 
monitoring function provided by CNMS 222) using conventional 
communications protocols such as frame relay (FR, an access standard defined by 
the ITU-T in the 1.122 recommendation "Framework for Providing Additional 
Packet Mode Bearer Services"), internet protocol (IP), FT1 (fractional Tl), Tl/El 

25 (a digital transmission link with capacity of 1 .544 Megabits per second), FT3 

(fractional T3), T3 (capacity of 28 Tl lines), and/or OC3 (optical carrier level 3= 

12 
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three times the OC1 rate of 51.840 Mbps)(each of which is a conventional 
communications service well known to the art). 

In some embodiments, DPDSP 300 provides a VPN 410, using secure 
connections across the internet 99, to connect remote offices 301 to one another. 
5 FIG. 4 is a block diagram of one embodiment of the present invention, a 

system 400 providing a plurality of virtual private networks 410, 420, 430, 440. 
VPNs 420, 430, and 440 are each equivalent to the VPN 410 that supports 
subscriber 1, except that they are for other subscribers. Each subscriber has a set 
of partitioned virtual routers 210. For example, subscriber 1 has two locations, 

10 41 1 and 412, connected in a VPN 410. VR 210 at location 41 1 can include some 
CPE 110 as well as support provided in system 201-1. VR210 at location 412 
can include some CPE 110 as well as support provided in system 201-2. These 
two VRs 210 establish a "tunnel," a secure connection, that allows them to 
maintain secure communications that support the VPN 410 even across packet 

1 5 networks such as the internet 99 . Each VR 2 1 0 is the equivalent of an 

independent hardware router. Since each VR 410 is supported by an object group 
211, objects can be easily added or omitted to enable customized services on a 
subscriber-by-subscriber basis to meet each subscribers individual needs. SMS 
221 .running on SP network 200 allows ease of service provisioning (dynamically 

20 adding additional processors/processing power when needed, reducing the 

processors/processing power used for VPN 410 when not needed). In some 
embodiments, DPNOS 223 uses an open Application Program Interface (API) to 
enable new services to be added to the platform whenever needed. 

In some embodiments, system 401 at a first site (e.g., an ISP premises 

25 locally connected to a customer office) includes IPSX 201-1 having a VR 210 

connected to CPE 117. This system 401 appears to the outside world as a single 
router having firewall services, server(s) and user(s), etc. These functions can be 
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provided by either or both VR 210 and CPE 117, thus allowing a customer to 
outsource many or most of these services to the service provider and DPSX 201-1. 
Similarly, system 402 at a second site (e.g., another ISP premises locally 
connected to a remote office of the same customer) includes BPSX 201-2 having a 
5 VR 210 connected to CPE 1 19. This system 402 also appears to the outside 

world as a single router having firewall services, server(s) and user(s), etc. These 
functions can be provided by either or both VR 210 and CPE 1 1 9, thus allowing a 
customer to outsource many or most of these services to the service provider and 
IPSX 201-2. 

10 FIG. 5 is a block diagram of one embodiment of the present invention, a 

ring-network hardware platform 230. Hardware platform 230 includes plurality 
of service "blades" 239 (i.e., an insertable and removable printed circuit card 
having one or more processors, each having its own CPU and memory) each 
connected in a ring configuration (such as a counter-rotating dual ring 232). In 

15 some embodiments, three types of blades 239 are provided: control blade 234 
(not shown here), processor blades 236 (providing such functions as point-to- 
point (PPTP) connectivity, firewall protection against hacking, intruders, or 
accidental access), and access blades 238 (providing such functions as NAT, 
encryption, and routing). 

20 FIG. 6 is a block diagram of one embodiment of the present invention, 

service processing switch 600. In some embodiments, service processing switch 
600 includes a hardware enclosure 230 having power supplies 241 that are hot- 
swappable, redundant, capable of automatic failover (when one fails, others take 
over), and which can be AC or DC sourced. In some embodiments, dual hot- 

25 swappable, variable speed fans 242 are provided. In some embodiments, 

software updates can be made without system downtime by swapping out all 
object groups 21 1 (virtual routers), changing the software modules, and then 
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resuming processing. In some embodiments, all service blades 239 are hot- 
swappable (they can be removed and/or inserted without bringing the system 
down) and include automatic failover from primary mode to protect mode. In 
some embodiments, dual counter-rotating rings 232 support primary and protect 
5 redundancy. In some embodiments, system 600 provides NEBS Level 3 

compliance and is Y2K ready, provides SONET (synchronous optical network) 
1+1 Line Protection Switching, and includes integrated metallic cross-connects to 
enable DS3 (digital signal level 3; 44,736,000 bits per second) blade automatic 
failover without touching the facility. 

10 FIG. 7 is a block diagram of one embodiment of the present invention, an 

integrated system 700 including conventional existing network elements. 
Integrated system 700 optionally includes conventional frame relay switch 326, 
M13 mux 327, DSLAM (DIGITAL SUBSCRIBER LINK ACCESS 
MULTIPLEXOR) 328, and RAS (REMOTE ACCESS SERVER) 329 connecting 

15 to customer's equipment such as CPE router 110 and dial-up system 3 10. In 
some embodiments, integrated system 700 optionally includes a core IP router 
720 and/or a core ATM switch as part of an SP core 98. This provides support 
for a large number of conventional technology standards, and interoperability 
with existing access-concentration and core-network elements. It also offers 

20 interworking between frame-relay networks and IP networks. Network address 
translation (NAT) enables enterprise subscribers to leave their network 
addressing untouched. It also enables one to merge IP and legacy networks into 
one, with continuity of service (COS) guarantees. 

FIG. 8 is a block diagram of one embodiment of the present invention, 

25 hardware elements 230 and software elements 220. Hardware elements 230 

include a 26-slot, two-sided chassis 831 having a 22-gigabit per second (Gbps) 
ring midplane 832. Service blades 239 can be hot plugged into midplane 832 
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form either side of chassis 831. Three types of service blades 239 are provided: 
control blades 234, processor blades 236, and access blades 238. In some 
embodiments, four processors are provided on each service blade 239, each 
processor having a CPU and its own memory, allowing specialized processing to 
5 be performed on various different daughter cards of the blades 239. 

In some embodiments, a single system chassis 83 1 provides a redundant 
back plane and blade-termination facilities 832. The access blades 238, processor 
blades 236, control blades 234, power supplies 241 and fan trays 242 are 

10 designed for hot-swappable operation - any of these components may be 

removed from service while the entire system remains operational. The metallic 
cross connect is a passive system that provides fail-over support to allow DS3 
and DS 1 access facilities to be switched from one access blade to another access 
blade should an access port or card fail. 

15 The phase 1 chassis provides 26 universal slots, each of which may be populated 
with control blades, access blades, and processor blades. To operate, the chassis 
must contain at least one control blade. Up to two control blades may be 
operational in a chassis at the same time. Access blades are added as input/output 
requirements grow, and processor blades are added as computation requirements 

20 scale. 

In some embodiments, each system 230 supports up to twenty-five 
processing blades (PB) 236. Each processor blade 236 is designed to support 
three hundred Mbps of full duplex traffic while delivering IP services including 
application firewall, LT2P, PPTP, NAT, VPN router. 
25 In some embodiments, each system 230 supports up to two control blades 

(CB) 234. CBs 234 provide overall system supervision, EP route calculation, 
software update management, and network management statistics logging 
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services. When two CBs 234 are operational within a chassis 831, they remain 
synchronized such that should either CB 234 fail, the other CB 234 automatically 
takes over system operation. In this process all active services remain in 
progress. Each control blade 234 is hot swappable, so that when proper 
procedures are followed, a failed or malfunctioning CB 234 may be removed 
from on operational system 230 without bringing down any customer services. 

In some embodiments, each CB 234 provides four ethernet interfaces for 
management traffic. Each ethernet interface has a distinct collision domain and 
may each be configured with a primary and secondary IP address. Ethernet 
interfaces designated for management use may be configured for primary and 
protected configurations, both sharing the same EP address, reducing ISP IP 
address requirements. The CB 234 ethernet interfaces may be configured for fully 
meshed communications over diverse paths to diverse operating systems. Each 
CB 234 is also equipped with a random # seed generator for use in security 
applications. 

In some embodiments, each system 230 supports up to twenty-five access 
blades (AB) 238. Access blades 238 provide physical line termination, hardware- 
assisted IP forwarding, hardware assisted encryption services, and hardware 
assisted queue management. Each access blade 238 is hot swappable, so that 
when proper procedures are followed, a failed or malfunctioning ab may be 
removed from on operational system 230 without bringing down any customer 
services. In some embodiments, 10/100 ethernet-, DS3-, and OC3-type access 
blades are supported by system 230. 

FIG. 9 is a block diagram of one embodiment of the present invention, 
multiprocessor system 900 using ring network 932. In some embodiments, each 
of two network rings 933 and 934 connect nodes 93 1 together, where each blade 
239 includes one or more nodes 931, and each node 931 is connected to one or 
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more processors 930. In some embodiments, each processor is a high-performace 
processor such as an R12K processor from MIPS Corporation. In one 
embodiment, each blade 239 includes four nodes 931, each having one processor 
930. Each processor 930 include its own CPU (central processing unit) 935 and 
memory 936, and optionally includes other hardware such as routers, encryption 
hardware, etc. Software tasks, in some embodiments, are split up such that one 
processor operates on one part of the data (e.g,. the Level 7 processing) and 
another processor operates on another part of the data (e.g., the Level 3 
processing). In other embodiments, the various processing portions of a task all 
10 run on a single processor, multiprocessing with other tasks that share that 
processor. Thus, the hardware provides scalability, where low-end systems 
include few processors that do all the work, and high-end systems include one 
hundred or more processors and the work is distributed among the processors for 
greater speed and throughput. In some embodiments, the plurality of processors 
15 930 in the ring configuration includes forming dual counter rotating ring 

connections 933 and 934, each connecting to each of the plurality of processors 
930. 

In some embodiments, a separate control ring 935 is provided, connected 
to all processors 930. Data passed on the control ring 935 allows control 
20 communications to be passed between processors, and in particular, allows the 
control blade to configure and control the other blades in IPSX 201. In other 
embodiments, control ring 935 is omitted, and its function is overlaid on rings 
933 and 934. 



25 Logical Queue Identifier^ 

In some embodiments, rings 933 and 934 are packet-passing rings. Each 
packet 950 placed in the rings includes a data portion 953 and a processor 
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element identifier (PEID 951) that identifies for each node 931 which processor 
that packet is destined for, for example a 16-bit PEED that specifies one of 65526 
PEs. If the PEID matches a processor on its particular node, the node 93 1 passes 
the packet to the proper processor 930; if not, the packet is forwarded to the next 
5 node 93 1 .. In some embodiments, each packet also includes a logical queue 

identifier (LQED) that identifies a software entity (for example, an object group 
for a particular VR 210) residing on that processor 930 for which the packet is 
destined. 

In some embodiments, every node 93 1 has a unique, globally unique (i.e., 

1 0 unique within an IPSX 20 1 , or within an ISP having a plurality of DPSXs 20 1 ) 

PEID 95 1 . In some embodiments, the way this is done is that one takes the blade 
ID (e.g., five bits) and you append the PE number, which is, for example, a 
eleven bits. Put that together in some fashion and you'll get a unique ID that is 
globally unique within some hardware configuration. Note that packets including 

15 this PEED 95 1 are routable. Just by looking at the PEID 951, the system 201 has 
a topological structure so that it can route based on.purely the PEID 95 1 . The 
next thing to keep in mind is that system 201 is managing multiple virtual 
context. Each VR 210 in a system 201 is a virtual router to which packet are to 
be directed. When packets come into node N 931 for example, system 201 needs 

20 to be able to steer it to the appropriate logical entity, i.e., to the appropriate 

context and to the object channel that it represents. Thus, a logical queue ID 952 
is appended that is unique within the destination processor<(PE) 930. If an object 
in a processor 930 on node 1 930 wants to set up a channel to another object a 
processor 930 on node N 930, they need to use the LQID 952. A first LQID 952 

25 and PEID 95 1 together represent the local end, and a second LQID 952 and PEID 
951 together represent the remote end of the object and so the system can map the 
corresponding object channel, defining the object channel that is going across the 
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network. From a networking perspective, PEED 951 looks like your IP address 
that routes packets like an IP address. But once you go to a particular node 931, 
the LQID looks like the UDP (User Datagram Protocol, a TCP/IP protocol 
describing how messages reach programs within a destination computer) code 
number. So system 201 (e.g., SMS 221) essentially signals and negotiates the 
proper LQID to have a channel going between those ends. This allows all the 
traffic coming into a PE 930 to be steered along the appropriate object path to the 
appropriate object channel on that object. 

In some embodiments, an object could be talking on another channel to 
another object, or to the same object, using a different channel. In which case 
each channel uses a different LQID 952, but the same PEID 95 1 . 

In some embodiments, system 201 sets up a shortcut that circumvents 
traffic that otherwise would be transmitted outside system 201 and then back in 
(e.g., traffic between two different VRs 210 supporting different customers). To 
set up such a shortcut, system 201 allocates a different LQID 952 for the shortcut. 
Thus, an object channel has the normal point-to-point path for normal traffic and 
has a multi-point-to-point path which is used for shortcut traffic. So when 
packets come in to the object it knows whether the packet came in on the normal 
path or on the shortcut path. Similarly, when the object wants to use a shortcut, it 
also needs to allocate a different LQID for its outbound shortcut traffic. One 
interesting distinction of shortcut paths is that the normal point-to-point is 
bidirectional and data can flow in both directions, but shortcuts data flow flows in 
only one direction. So a receive site can have any number of transferred sites. 
Any number of objects can be transmitting to the same receive site. That is why 
it is called multi-point-to-point. 

Further, some embodiments have different levels of shortcuts. For 
example, a packet can be sequentially passed to successive destinations in some 
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embodiments. Thus there can be a complex multistage path. The shortcuts can 
trickle down to the ultimate end, where the packet cascades. Further, if one 
object knows a shortcut, it can tell other objects about its shortcut. So the other 
object does not have to come to the first object and then be directed to the 
5 shortcut destination, but rather can directly use the shortcut it has learned about. 



While service providers recognize the tremendous revenue potential of 

1 0 managed firewall services, the cost of deploying, managing and maintaining such 
services via traditional CPE-based methods is somewhat daunting. Service 
providers are now seeking new service delivery mechanisms that minimize 
capital and operational costs while enabling high-margin, value-added public 
network services that are easily provisioned, managed, and repeated. Rolling out 

15 a network-based managed firewall service is a promising means by which to 

accomplish this. Deploying an IP Service Delivery Platform in the service 
provider network brings the intelligence of a managed firewall service out of the 
customer premises and into the service provider's realm of control. 

An IP Service Delivery Platform consists of three distinct components. 

20 The first is an intelligent, highly scalable IP Service Processing Switch. Next is a 
comprehensive Service Management System (SMS) to enable rapid service 
provisioning and centralized system management. The last component is a 
powerful Customer Network Management (CNM) system which provides 
enterprise customers with detailed network and service performance systems, 

25 enable self-provisioning, and eases IT managers fears of losing control of 
managed network services. 
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In a network-based managed firewall service model, the service provider 
replaces the high-capacity access concentration router at the POP with an IP 
Service Processing Switch. This is higher-capacity, more robust, and more 
intelligent access switch, with scalable processing up to 100+ RISC CPUs. Just 
as with the access router, additional customer access capacity is added via 
installing additional port access blades to the IP Service Processing Switch 
chassis. Unlike conventional access routers, however, additional processor 
blades are added to ensure wire-speed performance and service processing. 

The intelligence resident in the IP Service Processing Switch eliminates 
the need to deploy CPE devices at each protected customer site. Deployment, 
configuration, and management of the managed firewall service all take place 
between the IP Service Processing Switch 230 and its Service Management 
System 221, which resides on a high-end UNIX platform at the service provider 
NOC. The customer also has the ability to initiate service provisioning and 
augmentation via a web-based Customer Network Management tool that typically 
resides at the customer's headquarters site. This is an entirely different service 
delivery paradigm, requiring minimal or no truck rolls or on-site intervention. 

To roll out a managed network-based firewall service, the service 
provider's security staff provides a consultation to the enterprise, thereby gaining 
an understanding of the corporate network infrastructure and developing 
appropriate security policies (this is a similar process to the CPE model). Once 
this has been accomplished, the NOC security staff remotely accesses the DP 
Service Processing Switch (using the Service Management System 221) at the 
regional POP serving the enterprise customer, and the firewall service is 
provisioned and configured remotely. 

This model enables the service provider to leverage the enterprise's 
existing services infrastructure (leased lines and Frame Relay PVCs) to deliver 
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new, value-added services without the requirement of a truck roll. All firewall 
and VPN functionality resides on the IP Service Processing Switch at the POP, 
thus freeing the service provider from onsite systems integration and 
configuration and effectively hiding the technology from the enterprise customer. 
5 Firewall inspection and access control functions, as well as VPN tunneling and 
encryption, take place at the IP Service Processing Switch and across the WAN, 
while the enterprise's secure leased line or Frame Relay PVC (permanent virtual 
circuit) access link remains in place. The customer interface is between its router 
and the IP Service Processing Switch (acting as an access router), just as it was 
10 prior to the rollout of the managed firewall service. Additionally, the customer 
has visibility into and control over its segment of the network via the CNM that 
typically resides at the headquarters site. 



23 



WO 02/23855 



PCT/US01/28935 



Table 1 — Comparison Between CPE-based and Network-based Managed 
Firewall Turn-up Processes 



Process 


CPE-based Model 


Network-based Model 


Service Preparation 


Security consultation to 


Security consultation to 




identify customer 


identify customer 




requirements/policies 


requirements/policies 




CPE device(s) ordered 






CPE device(s) preconfigured 






CPE device(s) shipped to 






customer site 




Service Rollout 


Security technician deployed 


Service provisioning 




to site(s) 


and policy 




OS/Firewall/VPN software 
loaded (server-based model) 


configuration deployed 
from NOC via Service 
Management System 
(SMS) — No truck roll 
needed 




Physical network integration 
of device 


Additional Service 


Repeat above for each 


Add configuration 


Deployment 


additional service 


template to SMS and 
duplicate across all 
service points, provision 
with CNM — No truck 
roll 


Maintenance/Support 


Technician on phone with 


Technician at POP 




customer testing CPE and 


testing equipment 




technician at POP testing 






equipment 


— _ — 
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Mamtam inventory of spare 


Order 




units/components in service 


spares/replacement 




region 


from central vendor 




Ship spares to customer site 


repository — No truck 




as needed 


roll necessary 




Deploy technician to 


Integrate replacement 




customer site to complete 


unit component at POP 




repairs if necessary 





The network-based firewall model also enables service providers to 
quickly and cost-effectively roll out managed firewall solutions at all enterprise 
customer sites. As a result, secure Internet access can be provided to every site, 
5 eliminating the performance and complexity issues associated with backhauling 

Internet traffic across the WAN to and from a centralized secure access point. 

As the IP Service Delivery Platform is designed to enable value-added 
public network services, it is a carrier-grade system that is more robust and 
higher-capacity than traditional access routers, and an order of magnitude more 

10 scalable and manageable than CPE-based systems. The platform's Service 

Management System enables managed firewall services, as well as a host of other 
managed network services, to be provisioned, configured, and managed with 
point-and-click simplicity, minimizing the need for expensive, highly skilled 
security professionals and significantly cutting service rollout lead-times. The 

15 Service Management System is capable of supporting a fleet of IP Service 

Processing Switches and tens of thousands of enterprise networks, and interfaces 
to the platform at the POP from the NOC via IP address. Support for incremental 
additional platforms and customers is added via modular software add-ons. 
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Services can be provisioned via the SMS system's simple point and click menus, 
as well as requested directly by the customer via the CNM system. 

Deployment of a robust IP Service Delivery Platform in the carrier 
network enables service providers to rapidly turn-up high value, managed 
5 network-based services at a fraction of the capital and operational costs of CPE- 
based solutions. This enables service providers to gain a least-cost service 
delivery and support structure. Additionally, it enables them to gain higher 
margins and more market share than competitors utilizing traditional service 
delivery mechanisms — even while offering managed firewall services at a lower 
1 0 customer price point. 



15 



The following embodiments explore four specific managed firewall 
service delivery architectures usable by service providers, systems integrators, 
and hardware/software vendors. 



CPE-based Models 

Architecture One: Check Point/Nokia App liance 

This architecture employs a firewall/VPN CPE appliance, traditional 
access router, and software-based centralized management system to deliver a 
20 managed firewall solution. The specific components of this solution include: 

1 . Check Point/Nokia VPN-l/TP-330 appliance (50 user license) at branch 
sites 

2. Check Point VPN- 1 /Firewall- 1 software module (unlimited user license) 
on Sun Enterprise Ultra 250 server platform at headquarters 

25 3. Cisco 75 13 access router at the service provider's POP (redundant power, 

redundant RSP4) 
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4. Check Point Provider-1 management system at the service provider's 
NOC (supports 50 customers/ module) with unlimited sites/customer on 
Sun Ultra 60 platform at Network Operations Center (NOC) 

Figure 10 shows a block diagram of a system 1000 providing a Managed 
Firewall Service with a CheckPoint/Nokia Appliance Solution 

Architecture Two: Ch eck Point Server 

This architecture employs a firewall/VPN CPE server, traditional access 
router, and software-based centralized management system to deliver a managed 
firewall solution. The specific components of this solution include: 

5. Check Point VPN- 1 /Firewall- 1 software module (50 user license) on Sun 
5S server platform at branch sites 

6. Check Point VPN-l/Firewall-1 software module (unlimited user license) 
on Sun Enterprise Ultra 250 server platform at headquarters 

7 . Cisco 75 1 3 access router at the service provider POP (redundant power, 
redundant RSP4) 

8. Check Point Provider-1 management system (supports 50 customers/ 
module) with unlimited sites/customer on Sim Ultra 60 platform at NOC 

FIG. 1 1 shows a block diagram of a system 1 100, providing a Managed 
Firewall Service with a Checkpoint Firewall- 1 Server-based Solution. 

Architecture Three: W atchGuard Appliance Model 

This architecture employs a firewall/VPN CPE appliance, traditional 
access router, and software-based centralized management system to deliver a 
managed firewall solution. The specific components of this solution include: 
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9. WatchGuard Firebox II Plus appliance at branch sites 

1 0. Cisco 75 13 access router at the service provider POP (redundant power, 
redundant RSP4) 

1 1 . WatchGuard for MSS management system (supports 500 

> customers/module) with unlimited sites/customer on Compaq Proliant 

3000 Windows NT workstation platform, Event Processor on Sun 
Microsystems 5S server platform 



FIG. 12 shows a block diagram of a system 1200, providing a Managed 
10 Firewall Service with a WatchGuard Appliance Solution. The CPE-based 

managed firewall service model requires installation and configuration of system 
components at three network points: the service provider POP, the service 
provider NOC, and the customer premises. 

1 5 POP Infrastructure 

Each of the three CPE-based architectures explored in this analysis 
employs an identical POP infrastructure. This access infrastructure is based on 
the Cisco 7513 router. The base configuration for the 7513 includes: 





12. 


13-slot chassis 


20 


13. 


IOS Service Provider system software 




14. 


(2) power supplies 




15. 


(2) Route Switch Processors (RSP4) 




16. 


(2) RSP4 128MB DRAM Option 




17. 


(2) RSP4 20MB Flash Card Option 


25 


18. 


2-port Fast Ethernet Card 




19. 


64MB DRAM Option 




20. 


8MB SRAM Option 
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The RSP4 cards in this base configuration each consume one slot in the 
chassis, leaving 1 1 remaining for port adapters. An Ethernet card is added for 
software uploads. Ingress traffic is supported via dual-port channelized and/or 
dual-port unchannelized T3 cards (for dedicated T3 connections). Each 
5 channelized T3 port can support up to 128 DSO or NxTl channels Single-port 
OC-3 POS cards provide connectivity to the network uplink on the egress side. 
These cards each occupy a single slot. Each card requires a programmable 
Versatile Interface Processor (VIP2), as well as an additional 64MB of DRAM 
and 8MB of SRAM. The VIP2 and additional memory reside on the T3/OC-3 

10 cards and do not consume additional slots. 

As described in the assumptions, a traditional multiplexer exists at each 
POP to aggregate various sub-Tl customer access links up to the channelized T3 
interfaces on the Cisco 7513 router. As the POP infrastructure installation and 
configuration processes are uniform across all managed firewall service models 

1 5 explored in this analysis, the costs associated with these processes will not be 

quantified. 

Network-Based Model of the Present Inventi on- Architecture Four 

IP Service Delivery Platform 300 that includes an IP Service Processing 
20 Switch (IPSX 230), a Service Management System (SMS 221) and a Customer 

Network Management System (CNMS 222). 

This architecture employs an IP Service Processing Switch and a 

software-based centralized SMS to deliver a managed firewall solution. The 

specific components of this solution include: 
25 21. IPSX 230 (IP Service Processing Switch) at service provider POP 

22. Service Management System 221 on Sun Ultra 60 server at service 
provider NOC 



29 



WO 02/23855 



PCT/USO 1/28935 



23. InGage ™ Customer Network Management System at the subscriber's 
headquarters 



FIG. 13 shows a block diagram of a system 1300 that provides a Managed 
Firewall Service with CoSine's Network-based Solution of the present invention. 



POP Tnfrflfitrnr,tiTrft 

The POP access infrastructure in the network-based managed firewall 
service model is based on the CoSine Communications IPSX 9000 Service 
10 Processing Switch. The base configuration for the switch includes: 

24. 26-slot chassis 

25 . Redundant power supply 

26. IPNOS Base Software 

27. Ring Bridge & Ring Bridge Pass-Thru (to complete midplane) 

15 28 . Control Blade (for communications with Invision Services Management 

System) 

29. Dual-port Channelized DS3 Access Blade 

3 0 . Dual-port Unchannelized DS3 Access Blades 

3 1 . Processor Blade 

20 32. OC-3c POS Trunk Blade 



Analysis 

Analysis of the four service delivery architectures for deploying a 
managed firewall service reveals extremely compelling data in favor of 
25 implementing the network-based model based on the CoSine Communications IP 

Service Delivery Platform. Significant advantages are gained by utilizing this 
model in each of the following areas: 
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Operational "soft" Costs 

The network-based managed firewall solution eliminates most of the steep 
operational costs that are associated with deploying a CPE-based solution, 
specifically the per site truck roll and device installation charges. The 
5 CheckPoint server-based CPE deployment and installation operational costs alone 

exceed the total five-year capital equipment investment required in the CoSine 
Communications network-based model. These costs 1400 are shown in Figure 
14. Though the installation and configuration costs for the POP and NOC build- 
outs are not quantified in this study due to the uniformity of these processes 
10 across all solutions, it is worthy to note that the greater capacity of the CoSine 

IPSX 9000 Service Processing Switch and Invision Service Management System 
result in fewer components (switch chassis, NOC servers and software) that need 
to be installed and configured. 

15 Time to Market, Time to Revenue 

The network-based managed firewall solution enables service providers to 
greatly shorten the lead-time required to deploy the managed firewall service. 
The removal of the CPE component from the service offering eliminates the need 
to procure the device, eliminating a delay in service rollout. This also eliminates 
20 the delay that is associated with scheduling an onsite installation. 

Complexity 

The network-based managed firewall solution greatly reduces the 
complexity associated with deploying the service. The number of distributed 
25 devices is reduced from thousands of remote customer sites to only a few already 
staffed POPs, simplifying management and maintenance significantly. 



31 



WO 02/23855 



PCT/USO 1/28935 



The network-based managed firewall service model creates a new source 
of revenue for service providers that is scalable, repeatable, and cost-effective. 
Leveraging centrally-managed services enables service providers to derive greater 
value from the existing basic access infrastructure. The network-based model 
5 eliminates expensive onsite installation and maintenance required of CPE-based 
solutions, and provides a foundation to deploy additional value-added services 
via the same delivery mechanism. Elimination of the CPE device also effectively 
hides the technology of the managed firewall solution from the customer, 
reducing internal network complexity and technical anxiety. 

10 The CoSine Communications TP Service Delivery Platform 300 enables 

service providers to reap the benefits of deploying a network-based managed 
firewall service. The IPSX 9000 Service Processing Switch is a robust, high- 
availability platform that is capable of supporting hundreds of customer sites and 
network-based firewalls. The Invision Services Management System is capable 

1 5 of rapidly provisioning and managing thousands of managed firewall customers 
throughout an extensive nationwide network, enabling service providers to 
leverage volume security services driven by fewer staff resources. And the 
InGage™ Customer Network Management System empowers customer IT 
managers to view and augment managed network services. The IP Service 

20 Delivery Platform positions service providers to continuously deploy new value- 
added services to their customer base, maximizing revenues and creating 
customer lock-in. 

Service providers utilizing the IP Service Delivery Platform 300 are to 
gain a significant competitive edge in deploying high-value IP-based services. 
25 The CoSine Communications solution of the present invention enables 

services providers to save on the capital costs associated with deploying a 
managed firewall service over traditional CPE-based approaches. 
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Additionally, the CoSine solution of the present invention virtually 
eliminates the steep operational "soft" costs that plague the CPE approach. 
Furthermore, as customer numbers and bandwidth requirements increase 
over time, so do the cost savings. This enables service providers to gain a 
5 cost-leadership position while greatly increasing revenues. 

In closing, the EP Service Delivery Platform (IPSDP 300) is an ideal 
solution for service providers seeking to offer high value managed, network- 
based firewall services. 

One aspect of the present invention provides a method of packet routing. 

10 The method includes connecting a plurality of processors in a network, assigning 
a unique processor identifier (PEID) to each of the processors, routing a first 
packet to a first one of the processors across the network, wherein each such 
packet includes a PEID value corresponding to a PEED of one of the processors, 
and wherein the routing to the first processor is based on the PEID value in the 

15 first packet, establishing a plurality of objects in the first processor, assigning a 

logical queue identifier (LQID) to a first one of the objects in the first processor, 
wherein each packet also includes an LQID value corresponding to an LQID of 
one of the objects, and routing the first packet to the first object based on the 
LQID value in the first packet. 

20 Some embodiments further include assigning a plurality of different 

LQIDs to the first object. 

Some embodiments further include routing a plurality of packets, each 
having a different LQID, to the first object based on the LQID value in each 
respective packet. 

25 In some embodiments, the first object is associated with a virtual router 

(VR). 
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Some embodiments further include establishing the first LQID with the 
first object to be used for point-to-point data traffic, and establishing a second 
LQID with the first object to be used for shortcut data traffic. 

In some embodiments, the network is configured in a ring topology. 
5 Another aspect of the present invention provides a system for routing 

packets. This system includes a plurality of processors coupled to one another 
using a network, wherein each of the processors a unique processor identifier 
(PEID), wherein a first packet is routed into a first one of the processors across 
the network, wherein each such packet includes a PEED value corresponding to a 
1 0 PEID of one of the processors, and wherein the routing to the first processor is 
based on the PEID value in the first packet, a plurality of objects in the first 
processor, wherein each such object is assigned a logical queue identifier (LQID), 
wherein each packet also includes an LQID value corresponding to an LQID of 
one of the objects, and software for routing the first packet to the first object 
15 based on the LQID value in the first packet. 

In some embodiments, a plurality of different LQIDs are simultaneously 
assigned to the first object. 

In some embodiments, the means for routing includes means for routing a 
plurality of packets, each having a different LQID, to the first object based on the 
20 LQID value in each respective packet. 

In some embodiments, the first object is associated with a virtual router 

(VR). 

In some embodiments, the first LQID is associated with the first object to 
be used for point-to-point data traffic, and a second LQID is associated with the 
25 first object to be used for shortcut data traffic. 

In some embodiments, the network is configured in a ring topology. 
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Still another aspect of the present invention provides a system for routing 
packets. This system includes a plurality of processors coupled to one another 
using a network, wherein each of the processors a unique processor identifier 
(PEID), wherein a first packet is routed into a first one of the processors across 
the network, wherein each such packet includes a PEID value corresponding to a 
PEID of one of the processors, and wherein the routing to the first processor is 
based on the PEID value in the first packet, and a plurality of objects in the first 
processor, wherein each such object is assigned a logical queue identifier (LQID), 
wherein each packet also includes an LQED value corresponding to an LQID of 
one of the objects, wherein the first packet is routed to the first object based on 
the LQID value in the first packet. 

Some embodiments further include a services management system that 
provides changeable provisioning of processor capacity among a plurality of 
customers. 

Some embodiments further include a services management system that 
provides firewall protection for each of a plurality of customers. 

The network-based managed firewall service model creates a new source 
of revenue for service providers that is scalable, repeatable, and cost-effective. 
20 Leveraging centrally-managed services enables service providers to derive greater 

value from the existing basic access infrastructure. The network-based model 
eliminates expensive onsite installation and maintenance required of CPE-based 
solutions, and provides a foundation to deploy additional value-added services 
via the same delivery mechanism. Elimination of the CPE device also effectively 
25 hides the technology of the managed firewall solution from the customer, 
reducing internal network complexity and technical anxiety. 
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The CoSine Communications IP Service Delivery Platform 300 enables 
service providers to reap the benefits of deploying a network-based managed 
firewall service. The IPSX 9000 Service Processing Switch is a robust, high- 
availability platform that is capable of supporting hundreds of customer sites and 
5 network-based firewalls. The InVision Services Management System is capable 
of rapidly provisioning and managing thousands of managed firewall customers 
throughout an extensive nationwide network, enabling service providers to 
leverage volume security services driven by fewer staff resources. And the 
InGage™ Customer Network Management System empowers customer IT 
10 managers to view and augment managed network services. The IP Service 

Delivery Platform positions service providers to continuously deploy new value- 
added services to their customer base, maximizing revenues and creating 
customer lock-in. 

Service providers utilizing the IP Service Delivery Platform 300 are to 
15 gain a significant competitive edge in deploying high-value IP-based services. 

The CoSine Communications solution enables services providers to save on the 
capital costs associated with deploying a managed firewall service over 
traditional CPE-based approaches. Additionally, the CoSine solution of the 
present invention virtually eliminates the steep operational "soft" costs that 
20 plague the CPE approach. Furthermore, as customer numbers and bandwidth 
requirements increase over time, so do the cost savings. This enables service 
providers to gain a cost-leadership position while greatly increasing revenues. 

In closing, the IP Service Delivery Platform (JPSDP 300) is an ideal 
solution for service providers seeking to offer high value managed, network- 
25 based firewall services. 

In some embodiments, a set of one or more management consultants to 
the networking industry help equipment vendors, service providers and 
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enterprises make strategic decisions, mitigate risk and affect change through 
business and technology consulting engagements. This approach is tailored to 
each client's specific issues, objectives and budget. 

These consultants are leaders in the networking industry and influence its 
5 direction though confidential engagements for industry leaders and through 

public appearances and trade magazine articles. These interactions assure clients 
that they will be among the first to know of the latest industry concepts and 
emerging technology trends. 

Each consulting engagement is uniquely structured — no forced 
10 methodologies or canned reports are employed. An integrated client/management 
consultant case team respecting and soliciting the opinions of everyone is formed 
for each engagement. 

The present invention provides a flexible, scalable hardware and software 
15 platform that allows a service provider to easily provide internet services, virtual 
private network services, firewall services, etc., to a plurality of customers. This 
solution can be changes to provision each customer with more or less processing 
power and storage, according to individual changing needs. 

One aspect of the present invention provides a method of delivering 
20 security services. This method includes connecting a plurality of processors 930 
in a ring configuration within a first processing system, establishing a secure 
connection between the processors in the ring configuration across an internet 
protocol (IP) connection to a second processing system to form a tunnel, and 
providing both router services and host services for a customer using the plurality 
25 of processors in the ring configuration and using the second processing system. 

In some embodiments, one or more processors In some embodiments, to 
support a communications network, the plurality of processors includes one or 
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more control processors, one or more access processors, and one or more 
processing processors. 

In some embodiments, for each of a plurality of customers, a virtual router 
210 is formed in the first processing system 401 and is operably connected to a 
5 virtual router 210 formed in the second system 402. 

In some embodiments, for each of a plurality of customers, a virtual 
private network 410 is formed using a virtual router 210 formed in the first 
processing system 401 and operably connected to a virtual router 210 formed in 
the second system 402. 
10 In some embodiments, the connecting a plurality of processors in the ring 

configuration includes forming dual counter rotating ring connections 933 and 
934, each connecting to each of the plurality of processors 930. 

Another aspect of the present invention provides a system of delivering 
security services. This system 201 includes a plurality of processors 230 in a ring 
1 5 configuration within a first processing system 401 , and means for establishing a 
secure connection 418 between the processors in the ring configuration 4 1 1 
across an internet protocol (IP) connection to a second processing system 412 to 
form a tunnel, and for providing both router services and host services for a 
customer using the plurality of processors in the ring configuration 41 1 and using 
20 the second processing system 412. 

In some embodiments, to support a communications network, the plurality 
of processors includes one or more control processors, one or more access 
processors, and one or more processing processors. 

In some embodiments, for each of a plurality of customers, a virtual router 
25 is formed in the first processing system and is operably connected to a virtual 
router formed in the second system. 
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In some embodiments of this system, for each of a plurality of customers, 
a virtual private network is formed using a virtual router formed in the first 
processing system and operably connected to a virtual router formed in the 
second system. 

5 In some embodiments of this system, the plurality of processors in the 

ring configuration includes dual counter rotating ring connections, each 
connecting to each of the plurality of processors. 

Yet another aspect of the present invention provides a system 201 for 
delivering security services. This second system 201 includes a plurality of 
1 0 processors within a first processing system connected in a ring configuration, and 
a tunnel formed using a secure connection between the processors in the ring 
configuration across an internet protocol (IP) connection to a second processing 
system, wherein both router services and host services are provided for a 
customer using the plurality of processors in the ring configuration and using the 
1 5 second processing system. 

In some embodiments of this second system, to support a communications 
network, the plurality of processors 930 includes one or more control processors 
234, one or more access processors 238, and one or more processing processors 
236. In some embodiments, one or more of these processors is packaged on a 
20 blade 239. 

In some embodiments of this second system, for each of a plurality of 
customers, a virtual router 210 is formed in the first processing system 401 and is 
operably connected to a virtual router 210 formed in the second system 402. 
In some embodiments of this second system, for each of a plurality of 
25 customers, a virtual private network 410 is formed using a virtual router 210 

formed in the first processing system 401 and operably connected to a virtual 
router 210 formed in the second system 410. 
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In some embodiments of this second system, the plurality of processors 
230 in the ring configuration includes dual counter rotating ring connections 932 
and 933, each connecting to each of the plurality of processors 930. 

Some embodiments of this second system further include a services 
management system 221 that provides changeable provisioning of processor 
capacity among a plurality of customers. 

Some embodiments of this second system further include a services 
management system 221 that provides firewall protection for each of a plurality 
of customers. 

Some embodiments of this second system further include a services 
management system 221 that provides provisioning of processor capacity among 
a plurality of customers, wherein each customer's resources are isolated from 
those of all the other customers. 

It is understood that the above description is intended to be illustrative, 
and not restrictive. Many other embodiments will be apparent to those of skill in 
the art upon reviewing the above description. The scope of the invention should, 
therefore, be determined with reference to the appended claims, along with the 
full scope of equivalents to which such claims are entitled. 
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What is claimed is: 

1 . A method of delivering security services, comprising: 

connecting a plurality of processors within a first processing system; 
5 establishing a secure connection between the processors across an interne 

t protocol (IP) connection to a second processing system to form a tunnel; and 
providing both router services and host services for a customer using the 

plurality of processors and using the second processing system. 

10 2. The method of claim 1 , wherein, to support a communications network, 

the plurality of processors includes one or more control processors, one or more 
access processors, and one or more processing processors. 

3. The method of claim 2, wherein for each of a plurality of customers, a 

1 5 virtual router is formed in the first processing system and is operably connected 

to a virtual router formed in the second system. 

4. The method of claim 2, wherein for each of a plurality of customers, a 
virtual private network is formed using a virtual router formed in the first 

20 processing system and operably connected to a virtual router formed in the 

second system. 

5. The method of claim 1, wherein the connecting the plurality of processors 
includes connecting the plurality of processors in a ring configuration. 

25 

6. The method of claim 2, wherein the connecting the plurality of processors 
comprises connecting the plurality of processors in a ring configuration, and 
wherein the connecting a plurality of processors in the ring configuration 
includes forming dual counter rotating ring connections, each connecting to each 

30 of the plurality of processors. 

7. A system of delivering security services, comprising: 

a plurality of processors within a first processing system; 
means for establishing a secure connection between the processors across 
35 an internet protocol (IP) connection to a second processing system to form a 
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tunnel, and for providing both router services and host services for a customer 
who uses the plurality of processors and who uses the second processing system. 

8. The system of claim 7, wherein, to support a communications network, 
5 the plurality of processors includes one or more control processors, one or more 

access processors, and one or more processing processors. 

9. The system of claim 8, wherein for each of a plurality of customers, a 
virtual router is formed in the first processing system and is operably connected 

^ to a virtual router formed in the second system. 

10. The system of claim 8, wherein for each of a plurality of customers, a 
virtual private network is formed using a virtual router formed in the first 
processing system and operably connected to a virtual router formed in the 

20 second system. 

1 1 . The system of claim 8, wherein the plurality of processors includes dual 
counter-rotating ring connections, each connecting to each of the plurality of 
processors. 

12. The system of claim 7, wherein the plurality of processors are connected 
in a ring configuration. 

13. A system of delivering security services, comprising: 

a first plurality of processors within a first processing system connected 
to one another; and 

a tunnel formed using a secure connection between the connected 
processors across an internet protocol (IP ) connection to a second processing 
system, wherein both router services and host services are provided for a 
customer who uses the first plurality of processors and who uses the second 
processing system. 

14. The system of claim 13, wherein, to support a communications network, 
the first plurality of processors includes one or more control processors, one or 
more access processors, and one or more processing processors. 
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1 5 . The system of claim 1 3 , wherein for each of a plurality of customers, a 
virtual router is formed in the first processing system and is operably connected 
to a virtual router formed in the second system. 

5 

16. The system of claim 13, wherein for each of aplurality of customers, a 
virtual private network is formed using a virtual router formed in the first 
processing system and operably connected to a virtual router formed in the 
second system. 

10 

17. The system of claim 13, wherein the plurality of processors are connected 
in a ring configuration that includes dual counter rotating ring connections, each 
connecting to each of the first plurality of processors. 

15 18. The system of claim 13, further comprising a services management 

system that provides changeable provisioning of processor capacity among a 
plurality of customers. 

19. The system of claim 13, further comprising a services management 
20 system that provides firewall protection for each of a plurality of customers. 

20. The system of claim 13, wherein the plurality of processors are connected 
in a ring configuration. 

25 21. The system of claim 13, further comprising a services management 

system that provides provisioning of processor capacity among a plurality of 
customers, wherein each customer's resources are isolated from those of all the 
other customers. 
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